pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-07-17 14:35:25 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

move secrets-fo-users to it's own module

Browse source 
This preparation to support sysusers.
No behavior change.
This commit is contained in:
Jörg Thalheim 2024-02-08 13:11:04 +01:00 • committed by mergify[bot]
parent 23f61b897c
commit 00071af896
4 changed files with 160 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

37
modules/sops/secrets-for-users/default.nix Normal file
View file

@ -0,0 +1,37 @@
{ lib, config, pkgs, ... }:
let
cfg = config.sops;
secretsForUsers = lib.filterAttrs (_: v: v.neededForUsers) cfg.secrets;
manifestFor = pkgs.callPackage ../manifest-for.nix {
inherit cfg;
inherit (pkgs) writeTextFile;
};
withEnvironment = import ../with-environment.nix {
inherit cfg lib;
};
manifestForUsers = manifestFor "-for-users" secretsForUsers {
secretsMountPoint = "/run/secrets-for-users.d";
symlinkPath = "/run/secrets-for-users";
};
in
{
system.activationScripts = lib.mkIf (secretsForUsers != {}) {
setupSecretsForUsers = lib.mkIf (secretsForUsers != {}) (lib.stringAfter ([ "specialfs" ] ++ lib.optional cfg.age.generateKey "generate-age-key") ''
[ -e /run/current-system ] || echo setting up secrets for users...
${withEnvironment "${cfg.package}/bin/sops-install-secrets -ignore-passwd ${manifestForUsers}"}
'' // lib.optionalAttrs (config.system ? dryActivationScript) {
supportsDryActivation = true;
});
users = lib.mkIf (secretsForUsers != {}) {
deps = [ "setupSecretsForUsers" ];
};
};
assertions = [{
assertion = (lib.filterAttrs (_: v: v.owner != "root" || v.group != "root") secretsForUsers) == {};
message = "neededForUsers cannot be used for secrets that are not root-owned";
}];
system.build.sops-nix-users-manifest = manifestForUsers;
}